git.sur5r.net Git - openldap/blob - servers/slapd/sasl.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 #include "portable.h"
   8
   9 #include <ac/stdlib.h>
  10 #include <stdio.h>
  11
  12 #include "slap.h"
  13 #include "proto-slap.h"
  14
  15 #include <lber.h>
  16 #include <ldap_log.h>
  17
  18 #ifdef HAVE_CYRUS_SASL
  19 #include <limits.h>
  20 #include <sasl.h>
  21
  22 #include <ldap_pvt.h>
  23
  24 #ifdef SLAPD_SPASSWD
  25 #include <lutil.h>
  26 #endif
  27
  28 static sasl_security_properties_t sasl_secprops;
  29
  30
  31 static int
  32 slap_sasl_log(
  33         void *context,
  34         int priority,
  35         const char *message)
  36 {
  37         Connection *conn = context;
  38         int level;
  39         const char * label;
  40
  41         if ( message == NULL ) {
  42                 return SASL_BADPARAM;
  43         }
  44
  45         switch (priority) {
  46         case SASL_LOG_ERR:
  47                 level = LDAP_DEBUG_ANY;
  48                 label = "Error";
  49                 break;
  50         case SASL_LOG_WARNING:
  51                 level = LDAP_DEBUG_TRACE;
  52                 label = "Warning";
  53                 break;
  54         case SASL_LOG_INFO:
  55                 level = LDAP_DEBUG_TRACE;
  56                 label = "Info";
  57                 break;
  58         default:
  59                 return SASL_BADPARAM;
  60         }
  61
  62         Debug( level, "SASL [conn=%d] %s: %s\n",
  63                 conn ? conn->c_connid: -1,
  64                 label, message );
  65
  66         return SASL_OK;
  67 }
  68
  69 static int
  70 slap_sasl_authorize(
  71         void *context,
  72         const char *authcid,
  73         const char *authzid,
  74         const char **user,
  75         const char **errstr)
  76 {
  77         char *cuser;
  78         int rc;
  79         Connection *conn = context;
  80
  81         *user = NULL;
  82
  83         if ( authcid == NULL || *authcid == '\0' ) {
  84                 *errstr = "empty authentication identity";
  85
  86                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
  87                         "empty authentication identity\n",
  88                         (long) (conn ? conn->c_connid : -1),
  89                         0, 0 );
  90                 return SASL_BADAUTH;
  91         }
  92
  93         Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
  94                 "authcid=\"%s\" authzid=\"%s\"\n",
  95                 (long) (conn ? conn->c_connid : -1),
  96                 authcid ? authcid : "<empty>",
  97                 authzid ? authzid : "<empty>" );
  98
  99         if ( authzid == NULL || *authzid == '\0' ||
 100                 ( authzid[0] == 'u' && authzid[1] == ':' &&
 101                         strcmp( authcid, &authzid[2] ) == 0 ) ||
 102                 strcmp( authcid, authzid ) == 0 )
 103         {
 104                 /* authzid is:
 105                  *              empty
 106                  *              u:authcid
 107                  *              authcid
 108                  */
 109
 110                 size_t len = sizeof("u:") + strlen( authcid );
 111
 112                 cuser = ch_malloc( len );
 113                 strcpy( cuser, "u:" );
 114                 strcpy( &cuser[sizeof("u:")-1], authcid );
 115
 116                 *user = cuser;
 117
 118                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 119                         "\"%s\" as \"%s\"\n",
 120                         (long) (conn ? conn->c_connid : -1),
 121                         authcid, cuser );
 122
 123                 return SASL_OK;
 124         }
 125
 126         rc = slap_sasl_authorized( conn, authcid, authzid );
 127         if( rc ) {
 128                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 129                         " authorization disallowed (%d)\n",
 130                         (long) (conn ? conn->c_connid : -1), rc, 0 );
 131                 *errstr = "not authorized";
 132                 return SASL_NOAUTHZ;
 133         }
 134
 135         Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 136                 " authorization allowed\n",
 137                 (long) (conn ? conn->c_connid : -1), 0, 0 );
 138
 139         cuser = ch_strdup( authzid );
 140         dn_normalize( cuser );
 141         *errstr = NULL;
 142         *user = cuser;
 143         return SASL_OK;
 144 }
 145
 146
 147 static int
 148 slap_sasl_err2ldap( int saslerr )
 149 {
 150         int rc;
 151
 152         switch (saslerr) {
 153                 case SASL_CONTINUE:
 154                         rc = LDAP_SASL_BIND_IN_PROGRESS;
 155                         break;
 156                 case SASL_FAIL:
 157                         rc = LDAP_OTHER;
 158                         break;
 159                 case SASL_NOMEM:
 160                         rc = LDAP_OTHER;
 161                         break;
 162                 case SASL_NOMECH:
 163                         rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 164                         break;
 165                 case SASL_BADAUTH:
 166                         rc = LDAP_INVALID_CREDENTIALS;
 167                         break;
 168                 case SASL_NOAUTHZ:
 169                         rc = LDAP_INSUFFICIENT_ACCESS;
 170                         break;
 171                 case SASL_TOOWEAK:
 172                 case SASL_ENCRYPT:
 173                         rc = LDAP_INAPPROPRIATE_AUTH;
 174                         break;
 175                 default:
 176                         rc = LDAP_OTHER;
 177                         break;
 178         }
 179
 180         return rc;
 181 }
 182 #endif
 183
 184
 185 int slap_sasl_init( void )
 186 {
 187 #ifdef HAVE_CYRUS_SASL
 188         int rc;
 189         static sasl_callback_t server_callbacks[] = {
 190                 { SASL_CB_LOG, &slap_sasl_log, NULL },
 191                 { SASL_CB_LIST_END, NULL, NULL }
 192         };
 193
 194         sasl_set_alloc(
 195                 ch_malloc,
 196                 ch_calloc,
 197                 ch_realloc,
 198                 ch_free );
 199
 200         sasl_set_mutex(
 201                 ldap_pvt_sasl_mutex_new,
 202                 ldap_pvt_sasl_mutex_lock,
 203                 ldap_pvt_sasl_mutex_unlock,
 204                 ldap_pvt_sasl_mutex_dispose );
 205
 206         /* should provide callbacks for logging */
 207         /* server name should be configurable */
 208         rc = sasl_server_init( server_callbacks, "slapd" );
 209
 210         if( rc != SASL_OK ) {
 211                 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
 212                         0, 0, 0 );
 213                 return -1;
 214         }
 215
 216         Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
 217                 0, 0, 0 );
 218
 219         /* default security properties */
 220         memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
 221     sasl_secprops.max_ssf = INT_MAX;
 222     sasl_secprops.maxbufsize = 65536;
 223     sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
 224 #endif
 225
 226         return 0;
 227 }
 228
 229 int slap_sasl_destroy( void )
 230 {
 231 #ifdef HAVE_CYRUS_SASL
 232         sasl_done();
 233 #endif
 234         return 0;
 235 }
 236
 237 int slap_sasl_open( Connection *conn )
 238 {
 239         int sc = LDAP_SUCCESS;
 240
 241 #ifdef HAVE_CYRUS_SASL
 242         sasl_conn_t *ctx = NULL;
 243         sasl_callback_t *session_callbacks;
 244
 245         assert( conn->c_sasl_context == NULL );
 246         assert( conn->c_sasl_extra == NULL );
 247
 248         conn->c_sasl_layers = 0;
 249
 250         session_callbacks =
 251                 ch_calloc( 3, sizeof(sasl_callback_t));
 252         conn->c_sasl_extra = session_callbacks;
 253
 254         session_callbacks[0].id = SASL_CB_LOG;
 255         session_callbacks[0].proc = &slap_sasl_log;
 256         session_callbacks[0].context = conn;
 257
 258         session_callbacks[1].id = SASL_CB_PROXY_POLICY;
 259         session_callbacks[1].proc = &slap_sasl_authorize;
 260         session_callbacks[1].context = conn;
 261
 262         session_callbacks[2].id = SASL_CB_LIST_END;
 263         session_callbacks[2].proc = NULL;
 264         session_callbacks[2].context = NULL;
 265
 266         if( global_host == NULL ) {
 267                 global_host = ldap_pvt_get_fqdn( NULL );
 268         }
 269
 270         /* create new SASL context */
 271         sc = sasl_server_new( "ldap", global_host, global_realm,
 272                 session_callbacks, SASL_SECURITY_LAYER, &ctx );
 273
 274         if( sc != SASL_OK ) {
 275                 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
 276                         sc, 0, 0 );
 277                 return -1;
 278         }
 279
 280         conn->c_sasl_context = ctx;
 281
 282         if( sc == SASL_OK ) {
 283                 sc = sasl_setprop( ctx,
 284                         SASL_SEC_PROPS, &sasl_secprops );
 285
 286                 if( sc != SASL_OK ) {
 287                         Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
 288                                 sc, 0, 0 );
 289                         slap_sasl_close( conn );
 290                         return -1;
 291                 }
 292         }
 293
 294         sc = slap_sasl_err2ldap( sc );
 295 #endif
 296         return sc;
 297 }
 298
 299 int slap_sasl_external(
 300         Connection *conn,
 301         slap_ssf_t ssf,
 302         const char *auth_id )
 303 {
 304 #ifdef HAVE_CYRUS_SASL
 305         int sc;
 306         sasl_conn_t *ctx = conn->c_sasl_context;
 307         sasl_external_properties_t extprops;
 308
 309         if ( ctx == NULL ) {
 310                 return LDAP_UNAVAILABLE;
 311         }
 312
 313         memset( &extprops, '\0', sizeof(extprops) );
 314         extprops.ssf = ssf;
 315         extprops.auth_id = (char *) auth_id;
 316
 317         sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
 318                 (void *) &extprops );
 319
 320         if ( sc != SASL_OK ) {
 321                 return LDAP_OTHER;
 322         }
 323 #endif
 324
 325         return LDAP_SUCCESS;
 326 }
 327
 328 int slap_sasl_reset( Connection *conn )
 329 {
 330 #ifdef HAVE_CYRUS_SASL
 331         sasl_conn_t *ctx = conn->c_sasl_context;
 332
 333         if( ctx != NULL ) {
 334         }
 335 #endif
 336         /* must return "anonymous" */
 337         return LDAP_SUCCESS;
 338 }
 339
 340 char ** slap_sasl_mechs( Connection *conn )
 341 {
 342         char **mechs = NULL;
 343
 344 #ifdef HAVE_CYRUS_SASL
 345         sasl_conn_t *ctx = conn->c_sasl_context;
 346
 347         if( ctx != NULL ) {
 348                 int sc;
 349                 char *mechstr;
 350
 351                 sc = sasl_listmech( ctx,
 352                         NULL, NULL, ",", NULL,
 353                         &mechstr, NULL, NULL );
 354
 355                 if( sc != SASL_OK ) {
 356                         Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
 357                                 sc, 0, 0 );
 358                         return NULL;
 359                 }
 360
 361                 mechs = str2charray( mechstr, "," );
 362
 363                 ch_free( mechstr );
 364         }
 365 #endif
 366
 367         return mechs;
 368 }
 369
 370 int slap_sasl_close( Connection *conn )
 371 {
 372 #ifdef HAVE_CYRUS_SASL
 373         sasl_conn_t *ctx = conn->c_sasl_context;
 374
 375         if( ctx != NULL ) {
 376                 sasl_dispose( &ctx );
 377         }
 378
 379         conn->c_sasl_context = NULL;
 380
 381         free( conn->c_sasl_extra );
 382         conn->c_sasl_extra = NULL;
 383 #endif
 384
 385         return LDAP_SUCCESS;
 386 }
 387
 388 int slap_sasl_bind(
 389     Connection          *conn,
 390     Operation           *op,
 391     const char          *dn,
 392     const char          *ndn,
 393     struct berval       *cred,
 394         char                            **edn,
 395         slap_ssf_t                      *ssfp )
 396 {
 397         int rc = 1;
 398
 399 #ifdef HAVE_CYRUS_SASL
 400         sasl_conn_t *ctx = conn->c_sasl_context;
 401         struct berval response;
 402         unsigned reslen;
 403         const char *errstr;
 404         int sc;
 405
 406         Debug(LDAP_DEBUG_ARGS,
 407           "==> sasl_bind: dn=\"%s\" mech=%s datalen=%d\n", dn,
 408           conn->c_sasl_bind_in_progress ? "<continuing>":conn->c_sasl_bind_mech,
 409           cred ? cred->bv_len : 0 );
 410
 411         if( ctx == NULL ) {
 412                 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
 413                         NULL, "SASL unavailable on this session", NULL, NULL );
 414                 return rc;
 415         }
 416
 417         if ( !conn->c_sasl_bind_in_progress ) {
 418                 sc = sasl_server_start( ctx,
 419                         conn->c_sasl_bind_mech,
 420                         cred->bv_val, cred->bv_len,
 421                         (char **)&response.bv_val, &reslen, &errstr );
 422
 423         } else {
 424                 sc = sasl_server_step( ctx,
 425                         cred->bv_val, cred->bv_len,
 426                         (char **)&response.bv_val, &reslen, &errstr );
 427         }
 428
 429         response.bv_len = reslen;
 430
 431         if ( sc == SASL_OK ) {
 432                 char *username = NULL;
 433
 434                 sc = sasl_getprop( ctx,
 435                         SASL_USERNAME, (void **)&username );
 436
 437                 if ( sc != SASL_OK ) {
 438                         Debug(LDAP_DEBUG_TRACE,
 439                                 "slap_sasl_bind: getprop(USERNAME) failed!\n",
 440                                 0, 0, 0);
 441
 442                         send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
 443                                 NULL, "no SASL username", NULL, NULL );
 444
 445                 } else if ( username == NULL || *username == '\0' ) {
 446                         Debug(LDAP_DEBUG_TRACE,
 447                                 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
 448                                 0, 0, 0);
 449
 450                         send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
 451                                 NULL, "no SASL username", NULL, NULL );
 452
 453                 } else {
 454                         char *realm = NULL;
 455                         sasl_ssf_t *ssf = NULL;
 456
 457                         (void) sasl_getprop( ctx,
 458                                 SASL_REALM, (void **)&realm );
 459
 460                         (void) sasl_getprop( ctx,
 461                                 SASL_SSF, (void *)&ssf );
 462
 463                         Debug(LDAP_DEBUG_TRACE,
 464                                 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
 465                                 username ? username : "",
 466                                 realm ? realm : "",
 467                                 (unsigned long) ( ssf ? *ssf : 0 ) );
 468
 469                         *ssfp = ssf ? *ssf : 0;
 470
 471                         rc = LDAP_SUCCESS;
 472
 473                         if( username == NULL || (
 474                                 !strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) &&
 475                                 ( username[sizeof("anonymous")-1] == '\0' ||
 476                                   username[sizeof("anonymous")-1] == '@' ) ) )
 477                         {
 478                                 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
 479                                         0, 0, 0);
 480
 481                         } else if ( username[0] == 'u' && username[1] == ':'
 482                                 && username[2] != '\0' )
 483                         {
 484                                 *edn = ch_malloc( sizeof( "uid=,cn=" )
 485                                         + strlen( &username[2] )
 486                                         + ( realm ? strlen( realm ) : 0 ) );
 487
 488                                 strcpy( *edn, "uid=" );
 489                                 strcat( *edn, &username[2] );
 490
 491                                 if( realm && *realm ) {
 492                                         strcat( *edn, ",cn=" );
 493                                         strcat( *edn, realm );
 494                                 }
 495
 496                                 if( dn_normalize( *edn ) == NULL ) {
 497                                         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
 498                                                 "authzid (\"%s\") to authzdn failed: \"%s\"\n",
 499                                                 username, *edn, 0);
 500                                         ch_free( *edn );
 501                                         *edn = NULL;
 502                                         rc = LDAP_INAPPROPRIATE_AUTH;
 503                                         errstr = "could not form a valid DN from authzid";
 504
 505                                 }  else {
 506                                         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
 507                                                 "authzdn: \"%s\"\n",
 508                                                 *edn, 0, 0);
 509                                 }
 510
 511                         } else if ( username[0] == 'd' && username[1] == 'n'
 512                                 && username[2] != ':' && username[3] != '\0' )
 513                         {
 514                                 *edn = ch_strdup( &username[3] );
 515
 516                                 if( dn_normalize( *edn ) == NULL ) {
 517                                         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
 518                                                 "authzid (\"%s\") to authzdn failed: \"%s\"\n",
 519                                                 username, *edn, 0);
 520
 521                                         ch_free( *edn );
 522                                         *edn = NULL;
 523                                         rc = LDAP_INAPPROPRIATE_AUTH;
 524                                         errstr = "could not form a valid DN from authzid";
 525
 526                                 }  else {
 527                                         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
 528                                                 "authzdn: \"%s\"\n",
 529                                                 *edn, 0, 0);
 530                                 }
 531
 532                         } else {
 533                                 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
 534                                         "authzid (\"%s\") inappropriate form\n",
 535                                         username, 0, 0);
 536                                 rc = LDAP_INAPPROPRIATE_AUTH;
 537                                 errstr = "inappropriate authorization identity form";
 538                         }
 539
 540                         if( rc == LDAP_SUCCESS ) {
 541                                 if( ssf ) {
 542                                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 543                                         conn->c_sasl_layers++;
 544                                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 545                                 }
 546
 547                                 send_ldap_sasl( conn, op, rc,
 548                                         NULL, NULL, NULL, NULL,
 549                                         response.bv_len ? &response : NULL );
 550
 551                         } else {
 552                                 send_ldap_result( conn, op, rc,
 553                                         NULL, errstr, NULL, NULL );
 554                         }
 555                 }
 556
 557         } else if ( sc == SASL_CONTINUE ) {
 558                 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
 559                         NULL, NULL, NULL, NULL, &response );
 560
 561         } else {
 562                 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
 563                         NULL, errstr, NULL, NULL );
 564         }
 565
 566         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
 567
 568 #else
 569         send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
 570                 NULL, "SASL not supported", NULL, NULL );
 571 #endif
 572
 573         return rc;
 574 }
 575
 576 char* slap_sasl_secprops( const char *in )
 577 {
 578 #ifdef HAVE_CYRUS_SASL
 579         int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
 580
 581         return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
 582 #else
 583         return "SASL not supported";
 584 #endif
 585 }